CCP Security Operations & Incident Response 3 — Questions and Answers
Question 1: Which of the following BEST describes the difference between a 'false positive' and a 'false negative' in intrusion detection?
- A false positive detects real attacks; a false negative misses them
- A false positive alerts on benign activity; a false negative fails to alert on real attacks (Correct answer)
- A false positive is a low-severity alert; a false negative is high-severity
- A false positive occurs during day shift; a false negative occurs at night
Correct answer: A false positive alerts on benign activity; a false negative fails to alert on real attacks
False positives create alert fatigue by flagging legitimate activity, while false negatives are more dangerous as real threats go undetected.
Question 2: When performing memory forensics on a compromised Windows host, which tool is commonly used to capture a volatile memory image?
- Autopsy
- Volatility
- WinPmem / DumpIt (Correct answer)
- Sysinternals Process Monitor
Correct answer: WinPmem / DumpIt
WinPmem and DumpIt are live memory acquisition tools that capture a raw memory image; Volatility is then used to analyze the resulting dump.
Question 3: A security analyst discovers that an attacker used 'living off the land' techniques. This MOST likely means the attacker:
- Deployed custom malware compiled on-site
- Used legitimate OS tools like PowerShell and WMI to avoid detection (Correct answer)
- Physically entered a data center to install hardware implants
- Exploited vulnerabilities in agricultural IoT systems
Correct answer: Used legitimate OS tools like PowerShell and WMI to avoid detection
Living-off-the-land attacks leverage built-in OS utilities to blend in with normal operations and evade signature-based defenses.
Question 4: The MITRE ATT&CK framework is PRIMARILY used by SOC teams to:
- Automate firewall rule deployment
- Map observed adversary behaviors to known tactics and techniques (Correct answer)
- Generate compliance reports for auditors
- Schedule vulnerability scans
Correct answer: Map observed adversary behaviors to known tactics and techniques
ATT&CK provides a structured taxonomy of adversary TTPs that analysts use to categorize detections and identify coverage gaps.
Question 5: During incident triage, what does 'scoping' refer to?
- Calculating the financial cost of the breach
- Determining the full extent of systems and data affected by the incident (Correct answer)
- Writing the executive summary report
- Choosing which forensic tools to deploy
Correct answer: Determining the full extent of systems and data affected by the incident
Scoping defines the blast radius of an incident by identifying all compromised assets, accounts, and data to guide containment and remediation.
Question 6: Which artifact would BEST help determine user activity on a Windows system during a specific timeframe?
- The Windows Registry HKLM\SYSTEM hive only
- Windows Event Log (Security.evtx) combined with prefetch files (Correct answer)
- The hosts file
- DNS client cache
Correct answer: Windows Event Log (Security.evtx) combined with prefetch files
Security event logs record logon/logoff and process activity, while prefetch files show recently executed programs, together providing a timeline of user activity.
Question 7: A threat intelligence feed reports a new IOC (Indicator of Compromise). The FIRST action a SOC analyst should take is to:
- Immediately patch all systems
- Search historical logs to determine if the IOC has already appeared in the environment (Correct answer)
- Block the IOC and declare an incident
- Share the IOC publicly on social media
Correct answer: Search historical logs to determine if the IOC has already appeared in the environment
Retroactive hunting against historical data reveals whether the threat actor already operated in the environment before defenses were updated.
CCP Security Operations & Incident Response 3
Which of the following BEST describes the difference between a 'false positive' and a 'false negative' in intrusion detection?